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IAB Europe’s comments on the consultation on the Digital Services Act 
package - Executive Summary 


This document contains an overview of IAB Europe’s comments on the review of the legal framework 
for digital services, further to the European Commission stating in its 2020 work programme that it 
will propose a new Digital Services Act (DSA) to strengthen the single market and protect citizens 
and their rights, and Commission’s consultation launched thereafter. IAB Europe (Transparency 
Register: 43167137250-27) is the European-level association for the digital advertising and 
marketing ecosystem. 


e We recognise the importance of discussion to strengthen the single market and protect 
citizens and their rights. We find it critical for the European businesses to continue deriving 
value from their activity in the digital space, in particular, the European media for which 
advertising is the major revenue stream that consequently provides users with unpaid 
access to content and services. 


e We call on the policymakers to be cognisant of the existing regulatory framework, in 
particular, the EU privacy and data protection framework applicable to any business activity 
underpinned by data. The General Data Protection Regulation unambiguously established 
the principles of data protection in the digital advertising context. 


e Keeping users safe online is critical from the digital advertising industry perspective. 


o In doing so, one should acknowledge the difference between illegal and potentially 
harmful content. Existence of a well-established self-regulatory framework for 
advertising content allows consumers to lodge complaints about any type of 
advertising considered to be inappropriate. 


o The industry is committed to minimise the risk of advertising inadvertently funding 
websites hosting illegal or illicit content, as well as content considered to be 
disinformation with strong voluntary ‘follow-the-money’ measures. While 
eradicating such malpractice is challenging due to the boundless and pervasive 
nature of the internet, the industry has proven that technology standards and best 
practice and continuous investment in new methods and detection algorithms 
constitute the best possible approach. This allows for rapid reaction and significant 
improvement of the situation over time, further enabling innovation, to the 
advantage of the businesses and ultimately users benefiting from access to free ad- 
supported content that powers the ‘open web’. 


o Itis vital to keep in mind that from the user perspective, the EU privacy and data 
protection framework explicitly recognises a host of user rights from which 
consumers can benefit in relation to advertising powered by data. 


For additional information, please contact Greg Mroczkowski, Director, Public Policy at IAB Europe 
(mroczkowski@iabeurope.eu). 
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The industry is committed to maintaining transparency and quality across the digital 
advertising and marketing ecosystem, for all forms of trading. Industry-driven approaches 
and technical standards to generate said transparency should be recognised and supported 
by the policymaker. Given the ever-evolving technology, imposing prescriptive measures 
would stifle innovation and growth, besides the fact that any legal rules would very quickly 
become outdated. 


The existing liability regime reflects the reality of the market, whereby digital media is 
bought on behalf of the buyer. We do, however, welcome reflection on the ‘Good Samaritan’ 
provision, which could allow the digital advertising ecosystem players to continue voluntary 
monitoring without losing the benefit of the safe harbours. 


We are emphatically supportive of the so-called ‘open-web’ which relies on the interplay of 
a variety of market participants, from the buy- and sell-side, from technology and creativity. 
The ‘open web’ allows the market to remain sustainable and competitive, as it enables the 
all ecosystem players to continue deriving value from digital advertising and contributing to 
supporting the digital media. 
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IAB Europe’s comments on the consultation on the Digital Services Act 
package 
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IAB Europe (Transparency Register: 43167137250-27) represents 25 European national associations 
who in turn associate over 5,000 companies from across the digital advertising and marketing 
ecosystem, from advertisers and advertising agencies on the buy side, news publishers and other 
ad-funded sites and online services on the sell side, and technology providers facilitating the 
delivery of ads. We have over 90 companies in direct membership, including agencies, technology 
companies, publishers and eCommerce companies. 


In its 2020 work programme, the European Commission (Commission) stated that it will propose a 
new Digital Services Act (DSA) to strengthen the single market and protect citizens and their rights’, 
further to which public consultation was launched’. In addition to providing a direct response to said 
consultation, IAB Europe would like to take the opportunity to provide feedback on the themes 
discussed in connection with the DSA package, conveying the views of the digital advertising and 
marketing ecosystem. 


We recognise the importance of discussion to strengthen the single market and protect citizens and 
their rights. We find it critical for the European businesses to continue deriving value from their 
activity in the digital space, in particular, the European media for which advertising is the major 
revenue stream that consequently provides users with unpaid access to content and services. 
Advertising accounts for over 81% of European newspaper and magazine digital revenues, and any 
decrease in these monetisation opportunities supporting the objective, good-quality journalism 
would have serious consequences for the social and political landscape in Europe. 


To this end, we recommend the policymaker to ensure necessary flexibility in any rules and 
recognition of existing industry-driven approaches, in terms of keeping users safe online, 
maintaining transparency and quality across the digital advertising and marketing ecosystem, and 
allowing companies to undertake in good faith moderation or monitoring upon the wishes of the 
clients without losing the benefits of the safe harbours under the liability regime. The said flexibility 
is critical given the ever-evolving nature of technology - imposing any prescriptive measures would 
stifle innovation and growth, besides the fact that any legal rules would very quickly become 
outdated. 


The industry remains committed to working collectively to continuously improving the existing 
tools, standards and market-wide approaches. Only joined up and focused efforts can deliver 
desired results. Effectively, they also help in garnering support from across the ecosystem which is 
necessary to minimise the risk of illicit actors gaming the system to disadvantage of all concerned - 
consumers, market participants and the sector as such. It is important to appreciate that in such 
cases it is indeed the whole industry - advertisers and advertising agencies on the buy side, news 
publishers and other ad-funded sites and online services on the sell side, and technology providers 


1 European Commission, Commission Work Programme 2020, 29 January 2020. 
? European Commission, Commission launches consultation to seek views on Digital Services Act package, 2 June 2020. 
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as contributors to malpractice. 


Above all, while developing any new regulatory instruments, we call on the policymakers to be 
cognisant of the existing regulatory framework, in particular, the EU privacy and data protection 
framework applicable to any business activity underpinned by data. The General Data Protection 
Regulation (GDPR)? unambiguously established the principles of data protection in the digital 
advertising context. 


This paper has been framed in the following way: 


Part 1 - Introductory remarks on the industry and its value 
o Digital advertising and the European economy 
o Digital advertising - practical considerations and binding regulatory framework 


e Part 2 - Keeping users safe online from the digital advertising perspective 
o Self-regulatory framework for advertising content 

Follow-the-money approach to minimise ad misplacement 

The challenge of disinformation 

Digital political advertising 


O O O OỌ 


Relevance of the GDPR for user rights 
e Part3 -Transparency in digital advertising supply chain 
o Technical standards to generate transparency 
o Market-wide approaches to increase transparency and trust 


e Part4 - Liability regime of digital services 


e Part 5 - Sustainability and competitiveness of the digital advertising ecosystem 


3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016. 
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Part 1 - Introductory remarks on the industry and its value 


Digital advertising and the European economy 


Digital advertising is an umbrella term for a large range of activities. It stretches from paid-for search, 
over online banners, social media, video advertising, to digital audio and other emerging formats 
like out of home and connected TV, increasingly blending with traditional media. 


In Europe, digital ad spend amounts to 65bn*. But digital advertising’s estimated contribution to the 
wider EU economy exceeds €118 bn, while the industry powers over 1 mln jobs directly and over 6 
mln indirectly. Critically, Europe’s content economy depends on digital advertising, with advertising 
accounting for over 80% of European newspaper and magazine digital revenues”. Digital advertising 
ensures consumers can choose what they pay for, thus democratising access to information and 
other online services. In fact, European online users are happy for their data to be used for targeted 
advertising in order to get access to free content supported by advertising, and 83% would prefer 
free sites with ads to paying for ad-free content®. 


Digital advertising - practical considerations and binding regulatory framework 


In practice, the mechanics of the digital advertising ecosystem’ are underpinned by the ability to 
process data for advertising-related purposes, including but not limited to delivery and 
measurement of digital advertising. The data processed for the purpose of this type of activities may 
include IP addresses, online advertising identifiers, URLs of sites that users spend time on, 
information about user behaviour on those sites, and indications about the users’ physical 
whereabouts (“geolocation” data). Most or all of these data points are considered to be personal 
data under the GDPR. From this perspective, the EU privacy and data protection legal framework is 
the prime legal regime that the ecosystem players consider to be relevant. Currently, that regime is 
the conjunction of the GDPR and the ePrivacy Directive (2002/58/EC), with the former regulating the 
processing of personal data and the latter storage and access of information on a user’s device. 


Digital advertising has pioneered the better addressability of right audiences. Instead of relying just 
on broad demographics segments, digital advertising can use information about users’ online 
behaviour to assign them to large segments - or “audiences” - that all share common interests, and 
because of those common interests, may be interested in a specific good or service. The identity of 
aspecific individual consumer is not of interest to an advertiser. Rather, the aim is to create narrower 


4 AdEx Benchmark 2019 study, IAB Europe, 2020. Please note that while digital advertising grew 12.3% in 2019 to €64.8bn, 
driven by strong growth in out-stream video, mobile and social spend, and on average, €4bn has been added to the 
digital advertising market every year since 2006, 2020 will not follow the same trend due to the Covid-19 pandemic 
affecting all industries, businesses and lives. 

5 The Economic Contribution of Digital Advertising in Europe, IHS Markit, 2017. 

€ Europe Online: An Experience Driven by Advertising, GfK, 2017. 

7 There are many different digital advertising models, including but not limited to: ad servers, ad exchanges, SSPs, DSPs, 
DMPs, ad networks, attribution vendors, market research companies, data companies, affiliate marketing companies 
and cross device vendors. Each digital advertising company has its own unique characteristics. That said, in all instances 
the ecosystem as such relies on the interplay of a variety of market participants, from the buy and sell side, from 
technology and creativity. 
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segments. For instance, brand advertisers do not want or need to know who individuals are to reach 
customers that might enjoy their products or services. 


When done correctly, profiling and targeting also serves the interest of consumers. It ensures the 
provision of quality advertising that is likely to be relevant to them and reduces the chance of 
consumers being exposed to ads too frequently. 
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Part 2 - Keeping users safe online from the digital advertising perspective 


In trying to ensure that users are kept safe online, from the digital advertising perspective it is 
imperative to understand and address the issues at hand, which also envisages clearly 
differentiating between illegal and potentially harmful content. 


Self-regulatory framework for advertising content 


To start with, one should not confuse any malpractice with legal advertising practices, including 
native advertising’, advertorials? or sponsored content more broadly. Moreover, one should 
acknowledge the existence of a robust advertising self-regulatory system”, which covers 97% of all 
advertisements seen by the EU population, builds on the legal framework established by the Unfair 
Commercial Practices Directive and plays an essential role in preventing the spread of misleading or 
otherwise harmful advertising on all media, including online. The self-regulatory framework plays 
an important role in achieving a high level of consumer protection and trust, by striving to ensure 
that all covered advertising practices are legal, decent, honest and truthful. It features 
independently enforced codes of conduct and provides monitoring, training and compliance advice 
to the industry. The European bodies deal with on average 60,000 complaints per year and deliver 
an additional 90,000 pieces of tailored advice to the industry”. 


Follow-the-money approach to minimise ad misplacement 


Regrettably, legitimate advertising may appear on websites which host illegal or illicit content and 
revenues derived from advertising can partially or wholly fund such websites. 


It is important to appreciate that in such cases the whole industry - advertisers and advertising 
agencies on the buy side, news publishers and other ad-funded sites and online services on the sell 
side, and technology providers serving both sides - must be considered as collateral damage of 
intentional misbehaviour and not as contributors to malpractice. 


Minimising the risk of advertising inadvertently appearing on such sites can be facilitated with the 
use of brand safety tools and sound business practices. Brand safety describes an entire area of 
practice where advertisers, agencies and technology companies try to prevent advertising from 
being misplaced. The digital advertising industry is deeply invested in brand safety, as proven by our 
strong support for the European Commission’s “follow-the-money” approach, embodied in the 
Memorandum of Understanding (MoU) on misplacement of ads on websites that infringe intellectual 


8 Contextually targeted branded content, designed to fit in with the particular online environment to give consumers a 
visually consistent browsing experience and be less disruptive, while having prominent labelling to make clear that it’s a 
marketing communication. 

° Advertising, which provide advertising information in the style of an editorial or an objective journalistic article. 

1 European Advertising Standards Alliance (EASA) represents and coordinates the advertising self-regulatory systems 
across Europe. 

11 Estimates are based on average number of complaints and copy advice requests respectively, provided in the five-year 
period between 2014 and 2018. For more information please refer to EASA’s European annual statistics reports. 
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property rights. The European approach builds on experiences from national markets where a 


ope 


number of successful industry initiatives - beyond commercial offerings of independent providers - 
have emerged. Under the leadership of National IABs, European local markets are spearheading 
national-level initiatives to combat the phenomenon, for instance, DTSG Brand Safety (UK); 
Advertise Consciously (PL); AdKodex (DK). We believe that one of the ways in which the MoU on 
Online Advertising and IPR is helpful from the market perspective is that it facilitates convergence of 
similar initiatives, while also enabling new markets or players to develop their own, more nuanced 
approaches. 


In a recently published report on the functioning of the MoU”, the Commission acknowledged that 
industry cooperation has led to progress in tackling online piracy. The MoU has not only created 
more awareness among brands that their ads may end up on IPR-infringing websites, but more 
concretely, according to evidence gathered, the share of ads for European businesses on IPR- 
infringing websites has dropped by 12% since the introduction of the MoU, while gambling ads 
collected from major brands has decreased from 62% to 50% on these websites. We remain 
committed to honing the MoU and its approach, to address the challenge of ad misplacement in a 
yet more pointed way, further reducing instances where advertising funds any IPR-infringing digital 
properties. 


The challenge of disinformation 


Similarly, the digital advertising industry is committed to tackling the challenge of disinformation 
online. IAB Europe endorsed the EU Code of Practice on Disinformation”, recognising that legitimate 
online infrastructure can be misused by bad actors to deceive and confuse citizens, making it more 
difficult for them to make fact-based judgments, and ultimately undermining our democracies. 
Conversely, it is in our communal interest to ensure that the digital ecosystem primarily remains a 
powerful platform for the democratic dissemination of information and views. Though all 
manifestations of online disinformation do not leverage, or relate to, advertising, digital advertising 
may facilitate the creation and propagation of disinformation, for example, by inadvertently 
enabling the placing of legitimate advertising on websites enabling disinformation. Investment in 
brand safety tools can significantly contribute to reducing such ad misplacement. In this context, it 
is worthwhile noting the industry efforts to address the need for harmonised pan-European brand 


12 The Memorandum of Understanding (MoU) on Online Advertising and IPR is a voluntary agreement facilitated by the 
European Commission to limit advertising on websites and mobile applications that infringe copyright or disseminate 
counterfeit goods. In addition to the MoU efforts, IAB Europe has been supportive of the initiative embracing a similar 
approach spearheaded by the World Intellectual Property Organisation (WIPO), WIPO ALERT. WIPO ALERT is a secure, 
online platform to which authorized bodies in WIPO member states can upload details of websites or apps which have 
been determined to infringe copyright according to national rules. Access to the platform is given to any genuine digital 
advertising industry player which is willing to undertake to use the information solely for preventing the appearance of 
advertising on pirate websites. 

8 https://ec.europa.eu/docsroom/documents/42702. 

“The Code of Practice on Disinformation, unveiled in September 2018, addresses the spread of online disinformation. This 
is the first time worldwide that industry has committed, on a voluntary basis, to self-regulatory standards to fight 
disinformation. It aims at achieving the objectives set out by the Commission's Communication presented in April 2018 by 
setting a wide range of commitments, from transparency in political advertising to the closure of fake accounts and 
demonetization of purveyors of disinformation. The Code includes an annex identifying best practices that signatories will 
apply to implement the Code's commitments. 
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safety and brand suitability approaches!5, and collaboration with other partners, for instance, in the 
framework of the Global Alliance for Responsible Media (GARM)!° that aims to proactively and 
collectively address harmful and misleading media environments. 


Fact-checking organisations, or other specialised third-party providers can be leveraged as a best 
practice in terms of preventing ad misplacement in the context of tackling disinformation. The 
decision about possible collaboration with such providers by an ad intermediary should remain at 
the discretion of a buyer, such as an advertiser, or an agency working on their behalf. Any lists of 
websites arguably carrying disinformation must be curated by an independent third-party 
organisation, further to instructions of a buyer. Such a third-party organisation must be in a position 
take full responsibility for a claim regarding the alleged disinformational nature of a particular 
property. 


Looking to the future, IAB Europe fully supports the self-regulatory regime in the field of 
disinformation, given major concerns regarding the impact of any legislative influence on 
fundamental rights, including the freedom of speech and media. The agility and flexibility of 
voluntary commitments are critical, especially given the nature of an ever-changing online 
landscape. 


The above should not preclude other actions given the fact that disinformation is a multifaceted 
problem, requiring a comphrensive policy approach. We are also most supportive of continued EU- 
level investment in research to better understand the scope and nature of online disinformation, 
and in consumer education, notably in the area of media literacy, to increase people’s ability to 
critically assess information they receive. 


Digital political advertising 


While IAB Europe’s constituency remains primarily invested in brand advertising, we fully recognise 
that advertising may take different forms and shapes, and we are therefore strong advocates for any 
digital advertising - including non-commercial such as political advertising - meeting relevant legal 
and self-regulatory requirements. 


Political advertising can be characterised by the fact that it will be political actors themselves, such 
as politicians, political parties, etc., that assume a role of the advertiser. As with any advertising, the 
onus for the delivered campaign is ultimately on the advertiser. It must remain the same in case of 
political advertising. There should however be an agreement by political actors across the EU 


'S In July 2020, IAB Europe published its Guide to Brand Safety and Suitability, to share background context on brand safety 
in Europe, pan-European definitions for brand safety and brand suitability with accompanying key considerations, best 
practices and case studies to help educate all stakeholders on ensuring brand safe environments. The guide was 
developed by experts from IAB Europe’s Quality & Transparency Taskforce (a part of the Brand Advertising Committee). 
Formed in January 2020, the taskforce’s aim is to combat stakeholder quality and transparency concerns and address the 
challenges that the industry is facing in order to fuel consumer trust and brand investment in the digital advertising and 
marketing ecosystem. Following on from IAB Europe’s industry poll brand safety which demonstrated the need for more 
education and guidance, the taskforce agreed that their first priority was to address the need for harmonised pan- 
European brand safety and brand suitability definitions. 

16 https://wfanet.org/garm. 
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Member States, on what constitutes a political advertisement and how any rules pertaining to 


ope 


political advertising can be applied without prejudice to binding national-level electoral laws. 


In terms of digital political advertising, it should be noted that personal data revealing political 
beliefs is within the GDPR’s scope. Processing of such data is generally prohibited, albeit lawful 
processing can be allowed under certain conditions. Moreover, any restrictions on political 
advertising should be carefully assessed in light of fundamental rights, such as the right to freedom 
of expression guaranteed by Article 10 of the European Convention on Human Rights”. 


We sympathise with and encourage increased transparency into political advertising. The standard 
ad disclosure and transparency rules should be rigorously observed in case of political advertising. 
That enables citizens to immediately recognise when a paid-for communication is an ad. Moreover, 
the identity of the advertiser should be easily ascertainable. Finally, disclosures should be 
prominent and understandable to consumers. There exist industry-wide approaches to enhance 
transparency from non-EU jurisdiction that could be considered relevant in the EU!8, 


On arelated note, we appreciate the challenge with defining the so-called ‘issue-based’ advertising 
whereby certain ‘issues’ discussed in the context of elections can be regarded as a reminder of the 
fact that many of our public discussions can be viewed as politicized. Given our expertise in the field 
of brand advertising, we would respectfully advise that any future definition of ‘issue-based’ 
advertising must clearly exclude commercial advertising and business-oriented activity of brands 
that engage with their prospective clientele, and even take views on certain societal issues”. 


Finally, on the topic of databases of digital political advertising, we applaud efforts to devise 
approaches that allow for better understanding of political advertising targeting European citizens. 
Notwithstanding, as the industry body that promotes industry collaboration to deliver frameworks, 
standards and industry programmes, we would like to respectfully point out that the added value of 
open standards and joined up approaches manifests itself by the fact that they enable participation 
of all market players. In the specific example of a political ad library, creation of databases covering 
all EU media appears to be mostly problematic given the fragmented and unclear election legal 
framework. 


17 Against this background, in ECHR, Bowman v UK, Application No. 24839/94, Merits and Just Satisfaction, 19 February 
1988, the Court held that ‘publishing information with a view to influencing’ voters is an exercise of freedom of expression’ 
(para. 47). On this basis, it could be reasonably claimed that microtargeted digital political advertising is in scope of the 
definition of freedom of expression. 

!8 To enhance transparency, the US and Canadian markets saw introduction of a self-regulatory ‘Political Ad Icon’ initiative 
which serves as an immediate, simple, and intuitive tool for people to get information about the political ads covered by 
the Self-Regulatory Principles of Transparency & Accountability to Political Advertising. Under the Digital Advertising 
Alliances in the US and Canada Political Ads Programs, the Political Ad icon and/or wording should be used to provide 
clear, meaningful, and prominent notice that an ad is an express advocacy political advertisement for the election or defeat 
of a candidate for federal or certain state-wide elected office. Such approaches could be considered as relevant in the EU. 
' Engagement with expert stakeholders should inform developing optimal approaches, in full respect to the 
aforementioned as well as fundamental rights. An example of a good practice is IAB Canada's partnership with the 
Canadian Press to create a database that helps to track election-related issues in real time. The initiative is rooted in the 
amended Elections Canada Act which requires advertisers to register any campaign-related issue message in addition to 
the standard political advertising one is used to seeing. 
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Relevance of the GDPR for user rights 


The GDPR unambiguously establishes the principles of data protection in the digital advertising 
context. What is important from the user perspective is the fact that the legal framework explicitly 
recognises a host of user rights from which consumers can benefit in relation to advertising powered 
by data, which is essentially all advertising online. Any new regulatory framework should 
acknowledge the existence of such user rights in the GDPR and not duplicate them, or create legal 
uncertainty by introducing ambiguous related provisions. 


For background on relevance of the law for the industry, the scope of the law is comprehensive and 
guarantees the protection of personal data both in the context of electronic communication services 
and information society services. Pseudonymous identifiers (Rec. 26), online identifiers, such as 
cookies, and device identifiers, are examples of personal data under the GDPR (Art. 4(1), Rec. 30). In 
addition, the GDPR contains rules on profiling and provides enhanced rights to users where profiling 
takes place (Art. 4(4), Art. 22, Rec. 72), including where user behaviour is tracked online (Rec. 24). The 
GDPR also explicitly calls out online advertising (Rec. 58). 


The principle of fairness enshrined in the GDPR requires that users be informed of the fact that the 
supplier of an online service (or its partners) intends to process their personal data or is already 
doing so (Rec. 39). It also requires that they understand the purposes of the processing (Rec. 60), as 
well as whether they are obliged to provide the data in order to avail themselves of the service, and 
what would happen if they elected not to. Users should also not be subject to any decision based on 
automated processing without human intervention that produces legal or similarly grave effects on 
them (Rec. 71). The whole gamut of user rights is expressly recognized in the GDPR, and 
consequently applicable to instances where personal data is processed in relation to digital 
advertising. These include: right to know whether one’s personal data are being processed, right to 
know why one’s personal data are being processed, right to know the categories of personal data 
that are being processed, right to access the personal data that are being processed, right to 
information about whom the personal data have been, or will be, shared with (Art. 15), right to know 
how long personal data will be kept (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), 
right not to be the object of automated decision-making with legal or similar effects (Art. 22), right 
to data portability (Art. 20), right to object to having personal data processed (Art. 21), right to 
information as to where personal data in the possession of the data controller were originally 
obtained (Art. 15), right to be able to lodge a complaint with an appropriate authority (Art. 15), right 
to an effective judicial remedy against a controller or processor in case of a breach of the law (Art. 
79), right to compensation for damage suffered as a consequence of an infringement of the 
Regulation (Art. 82). 


Given the fact that the GDPR requires that individual users have full transparency about, and control 
over, any processing of their personal data, which consequently obliges data controllers to leverage 
arelevant legal ground for processing personal data and providing users with certain specific pieces 
of information in order for the processing to be legal, the industry has invested considerable 
resources in developing legal compliance solutions. 
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IAB Europe and its members created an open-source, cross-industry standard, the IAB Europe’s 
Transparency & Consent Framework” (TCF). It is to ensure that where personal data is processed in 
connection with the delivery and measurement of advertisements or the personalisation of editorial 
content, consumers as well as industry stakeholders benefit from transparency and control. The TCF 
standardises how websites make the information disclosures required by the GDPR, how the sites 
collect and log users’ choices, how they communicate those choices to their third-party technology 
partners, and what those partners may and may not do as a consequence. It delivers this 
functionality using a combination of software and a digital signal that is transmitted from each 
website to a defined set of technology partners with whom the website works. The signal captures 
which data processing purposes and data controllers the user has authorised, if any, and requires 
those receiving the signal to honour it in accordance with clearly defined rules. 


ope 


2 https://iabeurope.eu/tcf. 
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Part 3 - Transparency in digital advertising supply chain 
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Digital advertising trading can happen in a variety of ways. The industry is committed to maintaining 
transparency and quality across the digital advertising and marketing ecosystem, for all forms of 
trading. 


Technical standards to generate transparency 


Both the buy- and sell-side require optimal level of transparency and ad placement controls, to 
ensure that digital media buying, and ad placement processes occur in an orderly fashion. Only this 
approach allows the ecosystem to flourish. Advertisers ought to be provided with the ability to reach 
their desired audience in line with their brand commercial goals, and further evaluate ad 
performance and measure its effectiveness. On the other side of the supply chain, publishers require 
necessary controls to be in a position to oversee the types of ads that appear on their properties. 


As the ecosystem is ever-evolving, and new and more players join the open market, it is important 
to hone the approaches to generate transparency developed by the industry. Resources and 
technical tools, such as IAB Europe Supply Chain Transparency Guide”, IAB Tech Lab’s ads.txt”, 
sellers.json and OpenRTB Supply Chain object” allow for analysis of the supply chain** and are 
foundational for efforts to optimise it. These are not mere information material, but actual tools 
supplied to the industry. In addition, national standards have been developed in Europe, such as 
market-wide Programmatic Codes of Conduct”. 


These instruments help buyers and sellers of digital media to navigate through pertinent questions 
concerning data, cost and inventory source, or verify entities to ensure that only authorized players 
participate in ad transactioning. Despite the fact that the open market may on the surface come 
across as complex, due to the abundance of participants and offerings, it remains critically 
important to reach audiences at scale and to monetise inventory. In particular, given the fact that 
smaller players and publishers specifically rely on support from their technical providers. 


Overall, the issue is not with inaccessibility of information, but rather with managing complexity and 
having the right analytical and data science skills. On that note, one should not confuse alleged 


21 https://iabeurope.eu/research-thought-leadership/iab-europe-transparency-guide/. 

2 https://iabtechlab.com/ads-txt/. 

23 https://iabtechlab.com/sellers-json/, 

4 The initiatives and standards continue to evolve, to keep apace with technology and industry developments. For 
instance, more recently, the industry has been working together to standardise log level data fields and definitions. In 
February 2020, IAB Europe created a working group within the Programmatic Trading Committee tasked to look at Supply- 
Side Platforms (SSP) Data best practices. The group includes SSPs, publishers and agencies, to understand the differences 
across these data fields and to harmonise the reporting fields. 

25 The DACH (German speaking markets: Germany (D), Austria (A), and Switzerland (CH)), and Polish markets put in place 
Programmatic Codes of Conduct, which include commitments with precise rules for all market participants. The objective 
is to ensure quality in programmatic advertising as well as to achieve the highest possible transparency and sustainable 
professionalism in view of modes of operation and methods of the market participants. The signing parties obligate 
themselves at the very least to comply with the defined criteria and conditions and to make sure that their contractual 
partners are also in compliance. Complaints are handled in a standardised process that is binding for all parties, and the 
board of complaint will process all matters as well as review processes and violations against the commitment. As IAB 
Europe, we are working with members exploring the scalability of the instrument. 
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opacity in the ecosystem with the complexity of the industry, which has evolved considerably over 
the period of the last decade, notably as of 2010 with the inception of the Real-Time Bidding. IAB 
Europe is actively promoting education and relevant skills to get more people with those skills into 
digital advertising and help companies connect with such talent. 


ope 


Market-wide approaches to increase transparency and trust 


In this context, IAB Europe also continues to engage with its members to combat stakeholder quality 
and transparency concerns and address the challenges that the industry is facing in order to fuel 
consumer trust and brand investment in the digital advertising and marketing ecosystem. One can 
observe emergence of several market-wide programmes, driven by European National IABs”°, that 
are designed to increase transparency and trust in how digital advertising is bought and sold, built 
on more specific pillars such as brand safety, fraud prevention, viewability, user experience, and 
most recently, addressing the privacy concerns within the digital supply chain”. These initiatives 
include fully-fledged schemes with existing or to-be-developed monitoring and certification 
mechanisms. IAB Europe is working with members to share these best practices and help in 
harmonising relevant business standards across the continent. Giving brands, and other market 
participants alike, confidence that they are working with legitimate businesses, that the inventory 
traded is authentic, and finally, that ads are being placed in a safe environment helps to safeguard 
the sustainability of the digital advertising business model. 


Against this background, it should also appreciated that the IAB Europe’s Transparency & Consent 
Framework - originally established as a framework for legal compliance with the EU privacy and 
data protection regime - does, too, provide transparency and due diligence record keeping, hence 
contributing to accountability of parties collaborating in the ad placement process. 


We would encourage the EU policymakers to acknowledge the industry’s commitment to 
maintaining transparency and quality across the digital advertising and marketing ecosystem, for 
all forms of trading. Industry-driven approaches and technical standards to generate said 
transparency and increase trust should be recognised. Given the ever-evolving technology, 
imposing prescriptive measures would stifle innovation and growth, besides the fact that any legal 
rules would very quickly become outdated. It is also worthwhile remembering that policymaker 
recognition of such efforts would be most helpful in driving the market participation, and ensuring 
their continued uptake. 


% IAB Europe Navigator: Quality Initiatives (July 2020) demonstrates the vast amount of work being undertaken in Europe 
and beyond to build and ensure a sustainable future for digital advertising and marketing. There are both similarities and 
differences across all of these initiatives. It includes a summary of the work being undertaken in national markets such as 
quality certification schemes, guidelines and best practice guides. 

7 https://iabeurope.eu/blog/iab-uks-gold-standard-2-0-will-require-companies-to-adopt-iab-europes-tcf-v2-0/. 
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Part 4 - Liability regime of digital services 


ope 


The existing eCommerce Directive” governs ‘information society services’ (ISS) (Art. 1(b)(ii), Art. 
1(b)(iii) of the Information Society Services Directive’, and Art. 2(d), Rec. 18, Rec. 20 of the 
eCommerce Directive). It can be reasonably assumed that most of the players in the digital 
advertising ecosystem provide a service that may be deemed an ‘information society service’. 


The regime also governs ‘commercial communications’ which are part of, or constitute, an 
information society service (Art. 2(f), Art. 6). Commercial communications must be clearly 
identifiable as such, along with the natural or legal person on whose behalf the commercial 
communication is made and various other details such as the conditions for any promotional offers 
like discounts (Art. 6). They therefore impose a burden on those on behalf of whom they are made. 


This is relevant in a highly interconnected digital advertising ecosystem where parties collaborate 
to place advertisements and can be ultimately considered as subcontractors of one another. Most 
advertisements will constitute commercial communications if sent as part of an information society 
service and they will almost always be sent on behalf of a buyer. Most of the partners in the supply 
chain will not usually be involved in transmitting commercial communications, as it is the buyer’s 
ad server that normally transmits advertisements to the publisher. The advertiser is therefore 
generally the party on whose behalf an advertisement is made. The paradigm reflects the reality of 
the market, whereby it is the advertiser that is knowledgeable about the product or service 
advertised for, thus being in a position to take decisions about contents of advertising and its 
purpose, as well as other determinations regarding the media buying, for instance, the method of 
trading and desired target audience. 


The Directive also sets out various provisions governing the liability of ‘intermediary service 
providers’ (ISP). Where certain conditions are met, the providers are not liable for information 
transmitted or stored, as appropriate. Member States are also obliged not to monitor the 
information which they transmit or store, or a general obligation actively to seek facts or 
circumstances indicating illegal activity. A provider of an ISS is not automatically entitled to the safe 
harbours offered to ISPs under the Directive (Rec. 42). 


As a general rule, it is worthwhile recalling that while technical capacity and functions of specific 
players in the supply chain will differ, these players remain entities working on behalf of other 
parties, notably advertisers and publishers. Generally, the various players have no knowledge or 
control over the content, or data stored or transmitted. That said, it should be noted that many 
players may undertake various monitoring activities, in order to comply with the law but not limited 
to, for instance, to improve the quality and transparency of digital trading, minimize associated risk, 


8 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of 
information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic 
commerce’), OJ L 178, 17.7.2000. 

2° Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure 
for the provision of information in the field of technical regulations and of rules on Information Society Services. 
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or ensure measurement of the advertising itself or services provided - all further to wishes of their 


ope 


clients. 


One of the challenges of the current regime for ISS providers is that, if they undertake moderation 
or monitoring and obtain too high degree of knowledge or control of content or data, then they can 
lose the benefit of the safe harbours under the Directive. It would be unfortunate if by virtue of 
complying with the law or performing due diligence digital advertising players were losing the 
protection from liability that they enjoy due to additional knowledge or control that they may 
exercise over the content or data that they monitor. We, therefore, generally welcome reflection on 
the ‘Good Samaritan’ provision. 
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Part 5 - Sustainability and competitiveness of the digital advertising 
ecosystem 


ope 


IAB Europe is emphatically supportive of the so-called ‘open web’ which enables the broader 
ecosystem - comprising advertisers and advertising agencies on the buy side, news publishers and 
other ad-funded sites and online services on the sell side, and technology providers serving both 
sides - to continue deriving value from digital advertising and contributing to supporting the digital 
media. 


Against this background, it is worthwhile highlighting the role of the browsers in the online 
ecosystem, as well as existence of the vertically-integrated players and large publishers alike with 
rich first-party data sets. 


On the former, we have been consistently voicing our serious concerns about encouraging browsers 
and other software enabling access to the internet to provide the option to prevent the use of 
processing and storage capabilities of terminal equipment and the collection of information from 
end-user’s terminal equipment. Notably, the matter in question has surfaced in the context of Article 
10 of the proposed ePrivacy Regulation. IAB Europe believes that legislation should remain 
technologically neutral and not dictate which technologies must be used. 


On the latter, one should appreciate the volume of data that users willingly provide to the platforms 
and the greater traffic that larger publishers attract. The aforementioned enables such players to 
offer advertisers larger audiences who will likely be receptive to advertising about particular 
products and services. Smaller publishers and generalist sites such as news media are not well 
positioned to compete with that scale, yet to improve their situation these properties can rely on 
cross-site profiling that eventually helps them to attain asymmetrical leverage. 


We encourage EU policymakers to appreciate the fact that law-making does not take place in a 
vacuum, and there are real-life business considerations that ought to be taken into account while 
prescribing any new rules affecting the digital advertising and media supply chain. A case in point is 
the current industry-wide reflection on re-architecting the industry amid the demise of 3" party 
cookies that in the abstract enable smaller players to compete in the market?*!. 


3% Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the 
protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and 
Electronic Communications) (ePrivacy Regulation) (COM(2017) 10 final / 2017/0003 (COD)), 10 January 2017. 

3! Impending changes to the technology landscape for user tracking and identifiers are expected, including deprecation of 
3" party cookies. The existing technology is expected to be phased out expeditiously, in recognition of changing consumer 
expectations regarding privacy and personalisation. The industry has initiated conversations across the digital advertising 
and media supply chain to work together to re-architect the underlying infrastructure. The superseding technology must 
not only address consumers’ needs, but also ensure continued support of advertising-funded media and services available 
today. In June 2020, IAB Europe in partnership with IAB France inaugurated the work of a new joint initiative ‘The Post 
Third-Party Cookie Taskforce’. This follows on from IAB Europe’s earlier release of ‘The Post Third-Party Cookie Era Guide’, 
to prepare brands, agencies, publishers and tech intermediaries for the much-anticipated post-third-party cookie 
advertising ecosystem. The Taskforce will help to ensure strong European input into reflections being conducted on the 
evolution of digital advertising and potential new paradigms, within the World Wide Web Consortium's (W3C) Improving 
Web Advertising Business Group, and relevant industry fora such as IAB Tech Lab’s “Project Rearc”. 
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